Cross-Cluster Network Policy Enforcement via Label Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in extending network policy support beyond a single cluster to multiple clusters, particularly in enforcing security and controlling access to network resources across clusters.
Innovation Solution
The implementation of a method that involves determining a unique label identity for pods across clusters, incorporating this label identity into data packets, and using it to enforce network policies through virtual network identifiers, thereby enabling secure cross-cluster communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network policy enforcement is extended to multiple clusters, then security and access control across clusters is improved, but device complexity and implementation difficulty increase
Solution Approach 1:
The patent introduces an intermediary mechanism (label identity translation system) that translates cross-cluster traffic into local cluster policies. The label identity acts as a mediator that bridges the gap between different cluster networks, enabling policy enforcement without direct complex inter-cluster policy management. This resolves the contradiction by providing security through an intermediary layer rather than direct complex policy implementation across all clusters.
Solution Approach 2:
The patent segments the multi-cluster network policy enforcement into individual cluster-level policies. Each cluster maintains its own network policies independently, and the label identity mechanism enables coordination between segments without requiring a monolithic complex policy system. This segmentation approach improves security through localized policy enforcement while reducing overall system complexity.
2Measurement precision
If label identity is added to data packet headers for cross-cluster identification, then traffic matching accuracy is improved, but packet header size and processing overhead increase
Solution Approach 1:
The patent reuses the existing Virtual Network Identifier (VNI) field in packet headers for dual purposes: both its original function and as a carrier for label identity information. This multi-functional use of the VNI field achieves accurate traffic matching without increasing packet header size, thereby improving measurement precision while avoiding additional processing overhead from larger headers.
3Reliability
If network policies are enforced across multiple clusters, then security control is improved, but network performance and data exchange efficiency may deteriorate
Solution Approach 1:
The patent performs label identity translation and policy matching in advance, before actual data exchange occurs. By pre-establishing the mapping between label identities and network policies, and by performing the translation operation upfront, the system enables security control without adding real-time processing delays to data exchange operations. This preliminary action ensures security while maintaining high data exchange efficiency.
Data Source
AI summary
Techniques associated with exchanging data between clusters are disclosed. A data packet can be received from a first pod in a first cluster of a cluster set that targets a second pod or service in a second cluster of the cluster set. A label identity is determined for the first pod from a table of pods and label identities. The label identity for the first pod is added in a virtual network identifier field of a data packet header. The data packet is communicated from a first virtual switch to the second cluster through a tunnel interface and gateway node. Upon receipt of the data packet, the label identity is extracted from the data packet header, and an ingress rule associated with the label identity can be determined. Access to the second pod is controlled based on the rule.